/flags/entra-id/dsregcmd-status
dsregcmd /status: check if a device is Entra joined, hybrid joined or registered
- tool
- Microsoft Entra ID
- command
- dsregcmd
- flag
- /status
- default
- none: dsregcmd needs a switch; /? lists them
dsregcmd /status prints the Microsoft Entra device state of a Windows machine: whether it is Microsoft Entra joined, hybrid joined (joined to on-premises AD and registered in Entra ID), Microsoft Entra registered, or not connected at all, plus the device ID, certificate details, Windows Hello (NGC) state and the user's Primary Refresh Token (PRT) status. It is the first command to run when single sign-on, Intune enrolment or a device-based Conditional Access policy fails. Microsoft's guide: "Run the dsregcmd /status utility as a domain user account."
dsregcmd /status
dsregcmd /status | findstr /i "AzureAdJoined DomainJoined WorkplaceJoined AzureAdPrt"Switches
dsregcmd /? lists the switches. Output from Windows 11 (25H2, build 26200):
dsregcmd /?Output
DSREGCMD switches
/? : Displays the help message for DSREGCMD
/status : Displays the device join status
/status_old : Displays the device join status in old format
/join : Schedules and monitors the Autojoin task to Hybrid Join the device
/leave : Performs Hybrid Unjoin
/debug : Displays debug messages
/RefreshPrt : Refreshes PRT in the CloudAP cache
/RefreshP2PCerts : Refreshes P2P certificates
/CleanupAccounts : Deletes all WAM accounts
/ListAccounts : Lists all WAM accounts
/UpdateDevice : Update device attributes to Azure AD/status, /status_old, /ListAccounts and /? only display information. /join, /leave, /RefreshPrt, /CleanupAccounts and /UpdateDevice change the device or the user's accounts; /leave "Performs Hybrid Unjoin". Use them only as part of a planned fix.
Reading the Device State section
Microsoft's table maps the three values to a join type:
| AzureAdJoined | EnterpriseJoined | DomainJoined | Device state |
|---|---|---|---|
| YES | NO | NO | Microsoft Entra joined |
| NO | NO | YES | Domain joined only (not in Entra ID) |
| YES | NO | YES | Microsoft Entra hybrid joined |
| NO | YES | YES | On-premises DRS joined |
The Microsoft Entra registered state (a work account added to a personal or BYOD device) is shown as WorkplaceJoined : YES in the User State section, not in Device State.
Other fields worth checking
- DeviceId and Thumbprint: identify the device object in Entra ID; compare them with the device in the Entra admin center.
- DeviceCertificateValidity: an expired or invalid device certificate breaks device authentication.
- NgcSet: YES when a Windows Hello for Business key exists for the user.
- AzureAdPrt: YES when the user has a PRT;
AzureAdPrtUpdateTimeandAzureAdPrtExpiryTimeare in UTC. Diagnostic fields for PRT failures were added in Windows 10 21H1.
Pitfalls
- User context matters. Run it in the user's own, non-elevated session; output from an admin prompt or a remote SYSTEM shell can show a different user state.
- Hybrid join takes time. A newly hybrid-joined device shows
AzureAdJoined : NOuntil Entra Connect has synchronized the computer object and the device has completed registration. - Sign-in errors. A device that is joined but still fails sign-in shows the reason in the AADSTS code; see AADSTS error codes. Device-based policies are explained on Conditional Access.
FAQ
Should I run dsregcmd /status as administrator?
No. Microsoft says to run it as a domain user account, in the user context: the user state and SSO sections describe the signed-in user, and WamDefaultSet can show an error from an elevated prompt.
What does AzureAdPrt : NO mean?
The signed-in user has no Primary Refresh Token from Microsoft Entra ID, so single sign-on to Microsoft 365 and device-based Conditional Access do not work for that user. The diagnostic fields under AzureAdPrt explain the last failure.
How do I see the state of a hybrid join attempt?
Use dsregcmd /status for the current state and look at the diagnostics section; /join schedules and monitors the Autojoin task, and /debug adds debug messages. Run those only when you intend to change the join.